<!DOCTYPE HTML>
<html lang="en-US">

<!-- OneTrust Cookies Consent Notice start for trendmicro.com -->
<script type="text/javascript" src="https://cdn.cookielaw.org/consent/821060e3-3f9c-4a2f-8613-8e0db4841f79/OtAutoBlock.js"></script>
<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript" charset="UTF-8" data-domain-script="821060e3-3f9c-4a2f-8613-8e0db4841f79"></script>
<script type="text/javascript">function OptanonWrapper() { }</script>
<!-- OneTrust Cookies Consent Notice end for trendmicro.com -->

   	
	
	

	<script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/jquery.min.js"></script>
	<script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/utils.min.js"></script>

	<script type="text/javascript">
		if (typeof Granite !== "undefined" && Granite.I18n){
			Granite.I18n.setLocale("en_us" || "en");
		}
	</script>
	
    <head>
    
    
    
    
    <meta charset="UTF-8"/>
    <meta name="viewport" content="width=device-width"/>
	<meta name="description" content="In this blog entry, we analyze BlackSuit ransomware and how it compares to Royal Ransomware."/>
	<meta name="robots" content="index,follow"/>
	<meta name="keywords" content="endpoints,ransomware,research,articles, news, reports"/>
	<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"/>
	<meta name="template" content="article1withouthero"/>
    <meta property="article:published_time" content="2023-05-31"/>
    <meta property="article:tag" content="ransomware"/>
    <meta property="article:section" content="research"/>
    
    <link rel="icon" type="image/ico" href="/content/dam/trendmicro/favicon.ico"/>
	<link rel="canonical" href="https://www.trendmicro.com/en_us/research/23/e/investigating-blacksuit-ransomwares-similarities-to-royal.html"/>

    <title>Investigating BlackSuit Ransomware’s Similarities to Royal</title>
			 
    

    <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600" rel="stylesheet"/>
<link href="//customer.cludo.com/css/296/1798/cludo-search.min.css" type="text/css" rel="stylesheet"/>



    
    
    

    
    
    
    
<link rel="stylesheet" href="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css" type="text/css">
<link rel="stylesheet" href="/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.css" type="text/css">



    

    

    <script src="//tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js"></script>
	<meta property="og:url" content="https://www.trendmicro.com/en_us/research/23/e/investigating-blacksuit-ransomwares-similarities-to-royal.html"/>
<meta property="og:title" content="Investigating BlackSuit Ransomware’s Similarities to Royal"/>
<meta property="og:description" content="In this blog entry, we analyze BlackSuit ransomware and how it compares to Royal Ransomware."/>
<meta property="og:site_name" content="Trend Micro"/>
<meta property="og:image" content="https://www.trendmicro.com/content/dam/trendmicro/global/en/research/thumbnails/23/blacksuit-976.png"/>
<meta property="og:locale" content="en_US"/>

	<meta name="twitter:card" content="summary_large_image"/>
<meta name="twitter:site" content="@TrendMicro"/>
<meta name="twitter:title" content="Investigating BlackSuit Ransomware’s Similarities to Royal"/>
<meta name="twitter:description" content="In this blog entry, we analyze BlackSuit ransomware and how it compares to Royal Ransomware."/>
<meta name="twitter:image" content="https://www.trendmicro.com/content/dam/trendmicro/global/en/research/thumbnails/23/blacksuit-976.png"/>


<script>(window.BOOMR_mq=window.BOOMR_mq||[]).push(["addVar",{"rua.upush":"false","rua.cpush":"false","rua.upre":"false","rua.cpre":"false","rua.uprl":"false","rua.cprl":"false","rua.cprf":"false","rua.trans":"","rua.cook":"false","rua.ims":"false","rua.ufprl":"false","rua.cfprl":"false","rua.isuxp":"false","rua.texp":"norulematch"}]);</script>
                              <script>!function(e){var n="https://s.go-mpulse.net/boomerang/";if("False"=="True")e.BOOMR_config=e.BOOMR_config||{},e.BOOMR_config.PageParams=e.BOOMR_config.PageParams||{},e.BOOMR_config.PageParams.pci=!0,n="https://s2.go-mpulse.net/boomerang/";if(window.BOOMR_API_key="KL7L2-AE63W-6L875-PUGB2-GU2BB",function(){function e(){if(!o){var e=document.createElement("script");e.id="boomr-scr-as",e.src=window.BOOMR.url,e.async=!0,i.parentNode.appendChild(e),o=!0}}function t(e){o=!0;var n,t,a,r,d=document,O=window;if(window.BOOMR.snippetMethod=e?"if":"i",t=function(e,n){var t=d.createElement("script");t.id=n||"boomr-if-as",t.src=window.BOOMR.url,BOOMR_lstart=(new Date).getTime(),e=e||d.body,e.appendChild(t)},!window.addEventListener&&window.attachEvent&&navigator.userAgent.match(/MSIE [67]\./))return window.BOOMR.snippetMethod="s",void t(i.parentNode,"boomr-async");a=document.createElement("IFRAME"),a.src="about:blank",a.title="",a.role="presentation",a.loading="eager",r=(a.frameElement||a).style,r.width=0,r.height=0,r.border=0,r.display="none",i.parentNode.appendChild(a);try{O=a.contentWindow,d=O.document.open()}catch(_){n=document.domain,a.src="javascript:var d=document.open();d.domain='"+n+"';void(0);",O=a.contentWindow,d=O.document.open()}if(n)d._boomrl=function(){this.domain=n,t()},d.write("<bo"+"dy onload='document._boomrl();'>");else if(O._boomrl=function(){t()},O.addEventListener)O.addEventListener("load",O._boomrl,!1);else if(O.attachEvent)O.attachEvent("onload",O._boomrl);d.close()}function a(e){window.BOOMR_onload=e&&e.timeStamp||(new Date).getTime()}if(!window.BOOMR||!window.BOOMR.version&&!window.BOOMR.snippetExecuted){window.BOOMR=window.BOOMR||{},window.BOOMR.snippetStart=(new Date).getTime(),window.BOOMR.snippetExecuted=!0,window.BOOMR.snippetVersion=12,window.BOOMR.url=n+"KL7L2-AE63W-6L875-PUGB2-GU2BB";var i=document.currentScript||document.getElementsByTagName("script")[0],o=!1,r=document.createElement("link");if(r.relList&&"function"==typeof r.relList.supports&&r.relList.supports("preload")&&"as"in r)window.BOOMR.snippetMethod="p",r.href=window.BOOMR.url,r.rel="preload",r.as="script",r.addEventListener("load",e),r.addEventListener("error",function(){t(!0)}),setTimeout(function(){if(!o)t(!0)},3e3),BOOMR_lstart=(new Date).getTime(),i.parentNode.appendChild(r);else t(!1);if(window.addEventListener)window.addEventListener("load",a,!1);else if(window.attachEvent)window.attachEvent("onload",a)}}(),"".length>0)if(e&&"performance"in e&&e.performance&&"function"==typeof e.performance.setResourceTimingBufferSize)e.performance.setResourceTimingBufferSize();!function(){if(BOOMR=e.BOOMR||{},BOOMR.plugins=BOOMR.plugins||{},!BOOMR.plugins.AK){var n=""=="true"?1:0,t="",a="kbjpootiiuc3yzex4r6q-f-358bb2980-clientnsv4-s.akamaihd.net",i="false"=="true"?2:1,o={"ak.v":"36","ak.cp":"1340666","ak.ai":parseInt("807181",10),"ak.ol":"0","ak.cr":32,"ak.ipv":4,"ak.proto":"http/1.1","ak.rid":"ed7a418","ak.r":42727,"ak.a2":n,"ak.m":"a","ak.n":"essl","ak.bpcip":"80.82.247.0","ak.cport":54669,"ak.gh":"23.192.236.145","ak.quicv":"","ak.tlsv":"tls1.3","ak.0rtt":"","ak.csrc":"-","ak.acc":"reno","ak.t":"1687676029","ak.ak":"hOBiQwZUYzCg5VSAfCLimQ==k0p6dsDsuyZxmnIbVC4+HX5F/1JJ0KiEcFO8KtzC5+Q+96lhiPpXZxQHkW61cHNql+tWYaHm+Q3PBy/uIv8L3TdKGS0MLgcMVPWqvKOC0IL0F8VPk5QMh42KCdMjX9M09Ta4mpqhgn4sCBHwLIFzjaa6xn08GfyO8sQ1eR2k/VPzo6s9x0uOzNj5oEOMyGK/IvHPIYM0+Im30w41TNrhtUZu5PL9qzgyEpxkFsezIPt8ezer5OvdN8XKGnEasTJa28VNVg6/zU2jryc0l0hoD0l/MacjADW+f4yLKiGK7lyE/opO0oXim5YaRaO2N5UTi9QYbB6PjVq0aJvGL4iA22V7rgoG5DnkxbrmMEGE/lld9+7BqJdrjbJ5nvcFTt8NUdbpDrgOCUsJv+RyrzwsMPquRviy7tS330CZ2zYECL4=","ak.pv":"14","ak.dpoabenc":"","ak.tf":i};if(""!==t)o["ak.ruds"]=t;var r={i:!1,av:function(n){var t="http.initiator";if(n&&(!n[t]||"spa_hard"===n[t]))o["ak.feo"]=void 0!==e.aFeoApplied?1:0,BOOMR.addVar(o)},rv:function(){var e=["ak.bpcip","ak.cport","ak.cr","ak.csrc","ak.gh","ak.ipv","ak.m","ak.n","ak.ol","ak.proto","ak.quicv","ak.tlsv","ak.0rtt","ak.r","ak.acc","ak.t","ak.tf"];BOOMR.removeVar(e)}};BOOMR.plugins.AK={akVars:o,akDNSPreFetchDomain:a,init:function(){if(!r.i){var e=BOOMR.subscribe;e("before_beacon",r.av,null,null),e("onbeacon",r.rv,null,null),r.i=!0}return this},is_complete:function(){return!0}}}}()}(window);</script></head>
    
    <body class="articlepage page basicpage context-business">
		<!-- Page Scroll: Back to Top -->
		<a id="page-scroll" title="VerticalPageScroll" href="javascript:jumpScroll($(this).scrollTop());">
			<span class="icon-chevron-up"></span>
		</a>

        
                      
     		<!-- /* Data Layer */ -->
			<script type="text/javascript">
				var utag_data = {"customer_cookie_type":"business","language_code":"en_us","page_name":"research/23/e/investigating-blacksuit-ransomwares-similarities-to-royal/en_us","category_id":"en_us/research/23/e/investigating-blacksuit-ransomwares-similarities-to-royal","page_type":"unknown","site_section":"research","post_author":"Katherine Casona|Threat Analyst,Ivan Nicole Chavez|Threat Analyst,Ieriz Nicolle Gonzalez|Threat Analyst,Jeffrey Francis Bonaobra|Threat Research Engineer","post_date":"2023-05-31"};
			</script>

			<script type="text/javascript">(function(a,b,c,d){a='//tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js';b=document;c='script';d=b.createElement(c);d.src=a;d.type='text/java'+c;d.async=true;a=b.getElementsByTagName(c)[0];a.parentNode.insertBefore(d,a);})();</script>

            



            
<div class="businessHeaderV1">




<div class="headerAssemblyV1"><div class="headerassemblyv1 headerAssemblyV1">


<header class="page-header">

	
	<nav>
		<div class="header-bar">
			<div class="logo">
				
				<a id="header-logo" href="/en_us/business.html">
					<img src="/content/dam/trendmicro/global/en/core/images/logos/tm-logo-red-white-t.svg"/>
					<p>Business</p>
				</a>
			</div>
			<div class="inner-nav-wrapper">
				<span class="material-symbols-outlined search-icon">search</span>
				<span class="material-symbols-outlined close-search-icon">close</span>
				<input type="checkbox" id="checkbox" class="hamburger-menu"/>
				<div aria-label="Menu" class="hamburger"></div>
			</div>
		</div>

		<div class="hamburger-wrapper">
			<div class="mainNavMenuV1"><div class="mainNavMenu mainNavMenuV1">



<div class="list-wrapper inital-list-wrapper">
	<ul class="menu nav-level-0">
		<li>
			<!-- Level 0, top menu -->
			<div class="label">Solutions</div>
			<ul class="sub-menu nav-level-1">
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/solutions/challenges.html">By Challenge</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges.html">By Challenge</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">By Challenge</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/cyber-risk.html">Understand, Prioritize &amp; Mitigate Risks</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Understand, Prioritize &amp; Mitigate Risks</div>
			<p class="copy">Improve your risk posture with attack surface management</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/cyber-risk.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/cloud-native-applications.html">Protect Cloud-Native Apps</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Protect Cloud-Native Apps</div>
			<p class="copy">Security that enables business outcomes</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/cloud-native-applications.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/hybrid-cloud.html">Protect Your Hybrid World</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Protect Your Hybrid, Multi-Cloud World</div>
			<p class="copy">Gain visibility and meet business needs with security</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/hybrid-cloud.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/infrastructure-security.html">Securing Your Borderless Workforce</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Securing Your Borderless Workforce</div>
			<p class="copy">Connect with confidence from anywhere, on any device</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/infrastructure-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/network-security.html">Eliminate Network Blind Spots</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Eliminate Network Blind Spots</div>
			<p class="copy">Secure users and key operations throughout your environment</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/network-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/detection-response.html">See More. Respond Faster.</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">See More. Respond Faster.</div>
			<p class="copy">Move faster than your adversaries with powerful purpose-built XDR, attack surface risk management, and zero trust capabilities</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/detection-response.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/challenges/managed-services.html">Extend Your Team</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Extend Your Team. Respond to Threats Agilely</div>
			<p class="copy">Maximize effectiveness with proactive risk reduction and managed services</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/challenges/managed-services.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/solutions/role.html">By Role</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/role.html">By Role</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">By Role</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/role.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/role/ciso.html">CISO</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">CISO</div>
			<p class="copy">Drive business value with measurable cybersecurity outcomes</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/role/ciso.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/role/soc.html">SOC Manager</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">SOC Manager</div>
			<p class="copy">See more, act faster</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/role/soc.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/role/it-infrastructure-operations.html">Infrastructure Manager</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Infrastructure Manager</div>
			<p class="copy">Evolve your security to mitigate threats quickly and effectively</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/role/it-infrastructure-operations.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/role/cloud-developer.html">Cloud Builder and Developer</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Cloud Builder and Developer</div>
			<p class="copy">Ensure code runs only as intended</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/role/cloud-developer.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/role/cloud-operations.html">Cloud Security Ops</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Cloud Security Ops</div>
			<p class="copy">Gain visibility and control with security designed for cloud environments</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/role/cloud-operations.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/capabilities/solutions-for.html">By Industry</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/capabilities/solutions-for.html">By Industry</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">By Industry</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/capabilities/solutions-for.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/capabilities/solutions-for/healthcare.html">Healthcare</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Healthcare</div>
			<p class="copy">Protect patient data, devices, and networks while meeting regulations</p>
			<a class="leaf-button color-d71920" href="/en_us/business/capabilities/solutions-for/healthcare.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">Manufacturing</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Manufacturing</div>
			<p class="copy">Protecting your factory environments – from traditional devices to state-of-the-art infrastructures</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">Oil &amp; Gas</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Oil &amp; Gas</div>
			<p class="copy">ICS/OT Security for the oil and gas utility industry</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/iot/ics-ot.html">Electric Utility</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Electric Utility</div>
			<p class="copy">ICS/OT Security for the electric utility</p>
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/ics-ot.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/capabilities/solutions-for/federal-government.html">Federal</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Federal</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/capabilities/solutions-for/federal-government.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://vicone.com/en" target="_blank" rel="noopener noreferrer">Automotive</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Automotive</div>
			
			<a class="leaf-button color-d71920" href="https://vicone.com/en" target="_blank" rel="noopener noreferrer">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/solutions/iot/enterprise-5g-iot.html">5G Networks</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">5G Networks</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/solutions/iot/enterprise-5g-iot.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			</ul>
		</li>
	
		<li>
			<!-- Level 0, top menu -->
			<div class="label">Platform</div>
			<ul class="sub-menu nav-level-1">
				<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/one-platform.html">Platform</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			<div class="subtitle">Trend Vision One</div>
			<div class="title">Our Unified Platform</div>
			<p class="copy">Bridge threat protection and cyber risk management</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/one-platform.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/products/security-operations.html">Security Operations</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/security-operations.html">Security Operations</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			<div class="subtitle">Trend Vision One</div>
			<div class="title">Security Operations Overview</div>
			<p class="copy">A cloud-native security operations platform built to empower security teams</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/security-operations.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/detection-response/attack-surface-management.html">Attack Surface Management</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Attack Surface Management</div>
			<p class="copy">Operationalize a zero trust strategy</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/attack-surface-management.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/asrm-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/detection-response/xdr.html">XDR (Extended Detection &amp; Response)</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">XDR (Extended Detection &amp; Response)</div>
			<p class="copy">Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/detection-response/xdr.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/xdr-product-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/network/intrusion-prevention/threat-intelligence.html">Threat Intelligence</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Threat Intelligence</div>
			<p class="copy">Keep ahead of the latest threats and protect your critical data with ongoing threat prevention and analysis</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/network/intrusion-prevention/threat-intelligence.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/products/hybrid-cloud.html">Cloud Security</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/hybrid-cloud.html">Cloud Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			<div class="subtitle">Trend Cloud One</div>
			<div class="title">Cloud Security Overview</div>
			<p class="copy">The most trusted cloud security platform for developers, security teams, and businesses</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/hybrid-cloud/cloud-one-workload-security.html">Workload Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Workload Security</div>
			<p class="copy">Secure your data center, cloud, and containers without compromising performance by leveraging a cloud security platform with CNAPP capabilities</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud/cloud-one-workload-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-workload-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/hybrid-cloud/cloud-one-conformity.html">Cloud Security Posture Management</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Cloud Security Posture Management</div>
			<p class="copy">Leverage complete visibility and rapid remediation</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud/cloud-one-conformity.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-conformity-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/hybrid-cloud/cloud-one-container-image-security.html">Container Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Container Security</div>
			<p class="copy">Simplify security for your cloud-native applications with advanced container image scanning, policy-based admission control, and container runtime protection</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud/cloud-one-container-image-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-container-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/hybrid-cloud/cloud-one-file-storage-security.html">File Storage Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">File Storage Security</div>
			<p class="copy">Security for cloud file/object storage services leveraging cloud-native application architectures</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud/cloud-one-file-storage-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-file-storage-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/user-protection/endpoint-security.html">Endpoint Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Endpoint Security</div>
			<p class="copy">Defend your endpoints at every stage</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/user-protection/endpoint-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/user-protection-endpoint-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/hybrid-cloud/cloud-one-network-security.html">Network Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Network Security</div>
			<p class="copy">Advanced cloud-native network security detection, protection, and cyber threat disruption for your single and multi-cloud environments.</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud/cloud-one-network-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-network-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/hybrid-cloud/cloud-one-open-source-security-by-snyk.html">Open Source Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Open Source Security</div>
			<p class="copy">Visibility and monitoring of open source vulnerabilities for SecOps</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud/cloud-one-open-source-security-by-snyk.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-one-open-source-security-snyk-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/hybrid-cloud/cloud-sentry.html">Cloud Visibility</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Cloud Visibility</div>
			<p class="copy">As your organization continues to move data and apps to the cloud and transform your IT infrastructure, mitigating risk without slowing down the business is critical.</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/hybrid-cloud/cloud-sentry.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/cloud-sentry-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/products/network.html">Network Security</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/network.html">Network Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Network Security Overview</div>
			<p class="copy">Expand the power of XDR with network detection and response</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/network.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/network/intrusion-prevention.html">Network Intrusion Prevention (IPS)</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Network Intrusion Prevention (IPS)</div>
			<p class="copy">Protect against known, unknown, and undisclosed vulnerabilities in your network</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/network/intrusion-prevention.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/network/advanced-threat-protection.html">Breach Detection System (BDS)</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Breach Detection System (BDS)</div>
			<p class="copy">Detect and respond to targeted attacks moving inbound, outbound, and laterally</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/network/advanced-threat-protection.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/network/zero-trust-secure-access.html">Secure Service Edge (SSE)</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Secure Service Edge (SSE)</div>
			<p class="copy">Redefine trust and secure digital transformation with continuous risk assessments</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/network/zero-trust-secure-access.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/zero-trust-access-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/iot/industrial-network-security.html">Industrial Network Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Industrial Network Security</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/products/iot/industrial-network-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/products/user-protection.html">Endpoint &amp; Email Security</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/user-protection.html">Endpoint &amp; Email Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Endpoint &amp; Email Security Overview</div>
			<p class="copy">Protect your users on any device, any application, anywhere with Trend Micro Workforce One</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/user-protection.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/user-protection/endpoint-security.html">Endpoint Protection</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Endpoint Protection</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/products/user-protection/endpoint-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/enpoint-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/user-protection/sps/email-and-collaboration.html">Email Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Email Security</div>
			<p class="copy">Stop phishing, malware, ransomware, fraud, and targeted attacks from infiltrating your enterprise</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/user-protection/sps/email-and-collaboration.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/email-security-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/user-protection/sps/mobile-security-enterprise.html">Mobile Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Mobile Security</div>
			<p class="copy">On-premises and cloud protection against malware, malicious applications, and other mobile threats</p>
			<a class="leaf-button color-d71920" href="/en_us/business/products/user-protection/sps/mobile-security-enterprise.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/sps-mobile-security-enterprise-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products/iot/industrial-endpoint-security.html">Industrial Endpoint Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Industrial Endpoint Security</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/products/iot/industrial-endpoint-security.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/small-business/worry-free-services-suites.html">Small &amp; Midsized Business Security</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Small &amp; Midsized Business Security</div>
			<p class="copy">Stop threats with comprehensive, set-it-and-forget-it protection</p>
			<a class="leaf-button color-d71920" href="/en_us/small-business/worry-free-services-suites.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/small-business-worry-free-service-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
			
				<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/products.html">All Products, Services and Trials</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">All Products, Services and Trials</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/products.html">Learn more</a>
		</div>
		<div class="leaf-image">
			<img src="https://trendmicro.scene7.com/is/image/trendmicro/all-products-console-shot?scl=1.0&qlt=95&fmt=webp-alpha"/>
		</div>
	</li>

	
</ul>
</li>
			</ul>
		</li>
	
		<li>
			<!-- Level 0, top menu -->
			<div class="label">Research</div>
			<ul class="sub-menu nav-level-1">
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/about/threat-research.html">Research</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/threat-research.html">Research</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Research</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/threat-research.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/threat-research.html">About Our Research</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">About Our Research</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/threat-research.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/research.html">Research, News, and Perspectives</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Research, News, and Perspectives</div>
			
			<a class="leaf-button color-d71920" href="/en_us/research.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://www.trendmicro.com/vinfo/us/security/research-and-analysis/">Research and Analysis</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Research and Analysis</div>
			
			<a class="leaf-button color-d71920" href="https://www.trendmicro.com/vinfo/us/security/research-and-analysis/">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/research.html">Blog</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Blog</div>
			
			<a class="leaf-button color-d71920" href="/en_us/research.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://www.trendmicro.com/vinfo/us/security/news/" target="_blank" rel="noopener noreferrer">Security News</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Security News</div>
			
			<a class="leaf-button color-d71920" href="https://www.trendmicro.com/vinfo/us/security/news/" target="_blank" rel="noopener noreferrer">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://www.zerodayinitiative.com/about/" target="_blank" rel="noopener noreferrer">Zero Day Initiatives (ZDI)</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Zero Day Initiatives (ZDI)</div>
			
			<a class="leaf-button color-d71920" href="https://www.zerodayinitiative.com/about/" target="_blank" rel="noopener noreferrer">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			</ul>
		</li>
	
		<li>
			<!-- Level 0, top menu -->
			<div class="label">Services</div>
			<ul class="sub-menu nav-level-1">
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/business/services/service-one.html">Our Services</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/services/service-one.html">Our Services</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Our Services</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/services/service-one.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/services/service-one.html">Service Packages</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Service Packages</div>
			<p class="copy">Augment security teams with 24/7/365 managed detection, response, and support</p>
			<a class="leaf-button color-d71920" href="/en_us/business/services/service-one.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/services/managed-xdr.html">Managed XDR</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Managed XDR</div>
			<p class="copy">Augment threat detection with expertly managed detection and response (MDR) for email, endpoints, servers, cloud workloads, and networks</p>
			<a class="leaf-button color-d71920" href="/en_us/business/services/managed-xdr.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/services/support-services.html">Support Services</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Support Services</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/services/support-services.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			</ul>
		</li>
	
		<li>
			<!-- Level 0, top menu -->
			<div class="label">Partners</div>
			<ul class="sub-menu nav-level-1">
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/partners/channel-partners.html">Channel Partners</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners.html">Channel Partners</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Channel Partner Overview</div>
			<p class="copy">Grow your business and protect your customers with the best-in-class complete, multilayered security</p>
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners/managed-service-provider.html">Managed Service Provider</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Managed Service Provider</div>
			<p class="copy">Partner with a leading expert in cybersecurity, leverage proven solutions designed for MSPs</p>
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners/managed-service-provider.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners/cloud-service-provider.html">Cloud Service Provider</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Cloud Service Provider</div>
			<p class="copy">Add market-leading security to your cloud service offerings – no matter which platform you use</p>
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners/cloud-service-provider.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners/professional-services-partner.html">Professional Services</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Professional Services</div>
			<p class="copy">Increase revenue with industry-leading security</p>
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners/professional-services-partner.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners/resellers.html">Resellers</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Resellers</div>
			<p class="copy">Discover the possibilities</p>
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners/resellers.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners/marketplace.html">Marketplace</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Marketplace</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners/marketplace.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/channel-partners/systems-integrator.html">System Integrators</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">System Integrators</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/channel-partners/systems-integrator.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/partners/alliance-partners.html">Alliance Partners</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/alliance-partners.html">Alliance Partners</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Alliance Overview</div>
			<p class="copy">We work with the best to help you optimize performance and value</p>
			<a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/alliance-partners/technology.html">Technology Alliance Partners</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Technology Alliance Partners</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners/technology.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/alliance-partners/explore-alliance-partners.html">Our Alliance Partners</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Our Alliance Partners</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners/explore-alliance-partners.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/partners.html#tools">Partner Tools</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners.html#tools">Partner Tools</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Partner Tools</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners.html#tools">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://community-trendmicro.force.com/Gpartner/s/" target="_blank" rel="noopener noreferrer">Partner Login</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Partner Login</div>
			
			<a class="leaf-button color-d71920" href="https://community-trendmicro.force.com/Gpartner/s/" target="_blank" rel="noopener noreferrer">Login</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/business/services/support-services/education.html">Education and Certification</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Education and Certification</div>
			
			<a class="leaf-button color-d71920" href="/en_us/business/services/support-services/education.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/partner-stories.html">Partner Successes</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Partner Successes</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/partner-stories.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/distributors.html">Distributors</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Distributors</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/distributors.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/find-a-partner.html">Find a Partner</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Find a Partner</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/find-a-partner.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			</ul>
		</li>
	
		<li>
			<!-- Level 0, top menu -->
			<div class="label">Company</div>
			<ul class="sub-menu nav-level-1">
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/about/why-trend-micro.html">Why Trend Micro</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/why-trend-micro.html">Why Trend Micro</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Why Trend Micro</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/why-trend-micro.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/why-trend-micro.html">The Trend Micro Difference</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">The Trend Micro Difference</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/why-trend-micro.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/customer-stories.html">Customer Success Stories</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Customer Success Stories</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/customer-stories.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/human-connections.html">The Human Connection</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">The Human Connection</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/human-connections.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/industry-recognition.html">Industry Accolades</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Industry Accolades</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/industry-recognition.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/partners/alliance-partners.html">Strategic Alliances</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Strategic Alliances</div>
			
			<a class="leaf-button color-d71920" href="/en_us/partners/alliance-partners.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="/en_us/about.html">About Us</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about.html">About Us</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">About Us</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/trust-center.html">Trust Center</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Trust Center</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/trust-center.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/history-vision-values.html">History</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">History</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/history-vision-values.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/diversity-inclusion.html">Diversity, Equity and Inclusion</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Diversity, Equity and Inclusion</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/diversity-inclusion.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/corporate-social-responsibility.html">Corporate Social Responsibility</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Corporate Social Responsibility</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/corporate-social-responsibility.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/leaders.html">Leadership</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Leadership</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/leaders.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/leading-experts.html">Security Experts</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Security Experts</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/leading-experts.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/initiative-education.html">Internet Safety and Cybersecurity Education</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Internet Safety and Cybersecurity Education</div>
			
			<a class="leaf-button color-d71920" href="/en_us/initiative-education.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/legal.html">Legal</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Legal</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/legal.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/investor-relations.html" target="_blank" rel="noopener noreferrer">Investors</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Investors</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/investor-relations.html" target="_blank" rel="noopener noreferrer">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			
				<li>
<div class="label branch">
	<a class="menu-link" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Connect with Us</a>
</div>
<ul class="branch nav-item-2">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	

	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Connect with Us</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Connect with Us</div>
			
			<a class="leaf-button color-d71920" href="https://newsroom.trendmicro.com/" target="_blank" rel="noopener noreferrer">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="https://newsroom.trendmicro.com/">Newsroom</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Newsroom</div>
			
			<a class="leaf-button color-d71920" href="https://newsroom.trendmicro.com/">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/events.html">Events</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Events</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/events.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/careers.html">Careers</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Careers</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/careers.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
	<li>
<div class="label leaf">
	<a class="menu-link" href="/en_us/about/webinars.html">Webinars</a>
</div>
<ul class="leaf nav-item-leaf">
	<!-- This fake child menu should be a desktop enhancement only. Mobile never uses it -->
	<li class="desktop-leaf-child">
		<div class="desktop-leaf-child-text">
			
			<div class="title">Webinars</div>
			
			<a class="leaf-button color-d71920" href="/en_us/about/webinars.html">Learn more</a>
		</div>
		<div class="leaf-image">
			
		</div>
	</li>

	
</ul>
</li>
	
</ul>
</li>
			</ul>
		</li>
	</ul>
</div>

<div class="list-wrapper drop-down-menu-2">
	<button type="button" class="back-one-level">
		<span>Back</span>
	</button>
	<div class="sub-menu-wrapper"></div>
</div>

<div class="list-wrapper drop-down-menu-3">
	<button type="button" class="back-one-level">
		<span>Back</span>
	</button>
	<div class="sub-menu-wrapper"></div>
</div>

<div class="list-wrapper drop-down-menu-4">
	<button type="button" class="back-one-level">
		<span>Back</span>
	</button>
	<div class="sub-menu-wrapper"></div>
</div>

<div class="list-wrapper drop-down-menu-5">
	<button type="button" class="back-one-level">
		<span>Back</span>
	</button>
	<div class="sub-menu-wrapper"></div>
</div>



<div class="buttonArrayV1">





<ul class="button-array small left-align global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none">
	<li class="button-array-list">
		
	<a class="button  secondary color-ffffff normal" id="rsg-nav-free-trial-a34d5e" href="/en_us/business/products/trials.html#detection-response">
		Free Trials
	</a>

	</li>

	<li class="button-array-list">
		
	<a class="button  primary color-d71920 normal" id="rsh-nav-contact-us-b93ab0" href="/en_us/business/get-info-form.html">
		Contact Us
	</a>

	</li>
</ul>
</div>
</div>
</div>
			
			<div class="consumerLink">
				<a href="/en_us/forHome.html">Looking for home solutions?</a>
				
			</div>
			<a href="https://resources.trendmicro.com/GLB-Under-Attack-Form.html" class="under-attack-link">Under Attack?</a>
			<div class="alerts">
				<div class="alertUtilityMenu">
					<div class="utility-wrapper alert-top-menu">
						<div class="dropDownMenuV1">
							<div class="label"><span class="counter">0</span> </div>
							<div class="menu"><!--Intentionally left blank--></div>
						</div>
					</div>
					<div class="utility-wrapper alert-sub-menu">
						<button type="button" class="back-one-level-utility">
							<span>Back</span>
						</button>
						<div class="sub-wrapper-content">
							<div class="alerts-wrapper">
								<div class="alert-buttons">
									<div class="alerts-unread-button is-active"></div>
									<div class="alerts-all-button"></div>
								</div>
								<div class="sub-alerts-wrapper"></div>
							</div>

							
						</div>
					</div>
				</div>
			</div>

			<div class="utilityMenuV1"><div class="utilityMenu utilityMenuV1">


<div class="utility-wrapper standard-utility-wrapper">
	<div class="dropDownMenuV1">
		<div class="label">Support</div>
		<div class="menu">


<ul>
	<li>
		<a rel="noopener noreferrer" href="https://success.trendmicro.com/dcx/s/?language=en_US" target="_blank">
			Business Support Portal
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://success.trendmicro.com/virus-and-threat-help" target="_blank">
			Virus and Threat Help
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://success.trendmicro.com/renewals-and-registration" target="_blank">
			Renewals and Registration
		</a>
	</li>

	<li>
		<a href="/en_us/business/services/support-services/education.html">
			Education and Certification
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://success.trendmicro.com/dcx/s/contactus?language=en_US" target="_blank">
			Contact Support
		</a>
	</li>

	<li>
		<a href="/en_us/partners/find-a-partner.html">
			Find a Support Partner
		</a>
	</li>
</ul>
</div>
	</div>

	<div class="dropDownMenuV1">
		<div class="label">Resources</div>
		<div class="menu">


<ul>
	<li>
		<a href="/en_us/security-intelligence/breaking-news/cyber-risk-index.html">
			Cyber Risk Index/Assessment
		</a>
	</li>

	<li>
		<a href="/en_us/ciso.html">
			CISO Resource Center
		</a>
	</li>

	<li>
		<a href="/en_us/devops.html">
			DevOps Resource Center
		</a>
	</li>

	<li>
		<a href="/en_us/what-is.html">
			What Is?
		</a>
	</li>

	<li>
		<a href="https://www.trendmicro.com/vinfo/us/threat-encyclopedia/">
			Threat Encyclopedia
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="http://trendmicro.com/public-cloud-risk-assessment" target="_blank">
			Cloud Health Assessment
		</a>
	</li>

	<li>
		<a href="/en_us/business/capabilities/solutions-for/cyber-insurance.html">
			Cyber Insurance
		</a>
	</li>

	<li>
		<a href="https://www.trendmicro.com/vinfo/us/security/definition/a">
			Glossary of Terms
		</a>
	</li>

	<li>
		<a href="/en_us/about/webinars.html">
			Webinars
		</a>
	</li>
</ul>
</div>
	</div>

	<div class="dropDownMenuV1">
		<div class="label">Log In</div>
		<div class="menu">


<ul>
	<li>
		<a rel="noopener noreferrer" href="https://success.trendmicro.com/dcx/s/?language=en_US" target="_blank">
			Support
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://community-trendmicro.force.com/Gpartner/s/login/?language=en_US&ec=302&startURL=%2FGpartner%2Fs%2F" target="_blank">
			Partner Portal
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://cloudone.trendmicro.com/" target="_blank">
			Cloud One
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://tm.login.trendmicro.com/simplesaml/saml2/idp/SSOService.php" target="_blank">
			Product Activation and Management
		</a>
	</li>

	<li>
		<a rel="noopener noreferrer" href="https://signup.cj.com/member/signup/publisher/?cid=1867119#/branded?_k=xaeu3t" target="_blank">
			Referral Affililate
		</a>
	</li>
</ul>
</div>
	</div>
</div>
<div class="utility-wrapper active-utility-wrapper">
	<button type="button" class="back-one-level-utility">
		<span>Back</span>
	</button>
	<div class="sub-utility-wrapper"></div>
</div>
</div>
</div>
		</div>
	</nav>
</header>

<div class="search">
	<script type="text/javascript" src="//customer.cludo.com/scripts/bundles/search-script.js"></script>
	
	<script type="text/javascript">
		var cludoSettings = {};

		if( undefined === window.utag_data ) {
			cludoSettings.cludo_language = 'en';
		} else {
			switch (window.utag_data.language_code) {
				// Cludo dropped the ball on this one
				case 'ja_jp':
					cludoSettings.cludo_language = 'jp';
					break;
				case 'in_id':
					cludoSettings.cludo_language = 'id';
					break;
				default:
					cludoSettings.cludo_language = window.utag_data.language_code.substring(0, 2); // First two letters are the language
					break;
			}
		}

		cludoSettings.settingsObject = {
			customerId: 296,
			engineId: 1798,
			searchUrl: "/en_us/common/cse.html",
			searchInputs: ["cludo-search-form","cludo-search-form-mobile","cludo-search-content-form"],
			initSearchBoxText: "",
			language: cludoSettings.cludo_language,
			//endlessScroll: {stopAfterPage:3, resultsPerPage:10, bottomOffset: 145},
			//translateSearchTemplates: true,
			loading: "<div class='loader'></div>"
		};
	</script>

	<span class="material-symbols-outlined search-back-arrow">arrow_back</span>

	<div class="inner-search-wrap">
		<span class="material-symbols-outlined search-icon">search</span>
		<form class="main-menu-search" aria-label="Search Trend Micro">
			<div class="main-menu-search__field-wrapper" id="cludo-search-form">
				<table class="gsc-search-box">
					<tbody>
					<tr>
						<td class="gsc-input">
							<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search"/>
						</td>
					</tr>
					</tbody>
				</table>
			</div>
		</form>
		<span class="material-symbols-outlined search-clear-button">close</span>
	</div>
</div>
</div>
</div>

<section class="folder-indicators slider">
	<div class="folder-indicators__wrapper">
		<p class="folder-indicators__title">Content has been added to your Folio</p>
		<div class="folder-indicators__button-wrapper">
			<button class="folder-indicators__button counter" id="counter-folder">
				Go to Folio (<span>0</span>)
			</button>
			<button class="folder-indicators__button close"><span class="material-symbols-outlined close-folio-message">close</span></button>

		</div>
	</div>
</section></div>
<div class="root responsivegrid">


<div class="aem-Grid aem-Grid--12 aem-Grid--default--12 ">
    
    <div class="articleBodyNoHero aem-GridColumn aem-GridColumn--default--12"><div class="research-layout article container" role="contentinfo">
    <article class="research-layout--wrapper row" data-article-pageID="1770178462">
        <div class="col-xs-12 col-md-12 one-column">
            <div class="col-xs-12 col-md-12">
                <div class="article-details" role="heading">
	<span class="article-details__bar" role="img"></span>
	<p class="article-details__display-tag">Ransomware</p>
	<h1 class="article-details__title">Investigating BlackSuit Ransomware’s Similarities to Royal </h1>
	<p class="article-details__description">In this blog entry, we analyze BlackSuit ransomware and how it compares to Royal Ransomware.</p>
	<p class="article-details__author-by">By: Katherine Casona, Ivan Nicole Chavez, Ieriz Nicolle Gonzalez, Jeffrey Francis Bonaobra
		
			<time class="article-details__date">May 31, 2023</time>
		
		
		<span>Read time:&nbsp;</span><span class="eta"></span> (<span class="words"></span> words)
	</p>

	<div class="article-details__icons">
		<!--Add This-->
		<!-- Go to www.addthis.com/dashboard to customize your tools -->
<div class="addthis_toolbox addthis_default_style">
	<a class="addthis_button_compact addthis_link">
		<img src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg" class="addthis-icon" alt="Share"/>
	</a>
	<a class="addthis_button_print addthis_link">
		<img src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg" class="addthis-icon" alt="Print"/>
	</a>
</div>

		<!--Add to Folio-->
		<div class="add-to-folio tooltip">
			<span class="icon-folio-thin"></span>
			<div class="right">
				<p>Save to Folio</p>
				<i></i>
			</div>
		</div>

		<!--Subscribe-->
		<div class="subscribe">
			<a href="https://resources.trendmicro.com/subscription-us.html" title="Subscribe" data-modal-title="Subscribe" target="target">
				<span class="icon-subscribe"></span> <span class="text">Subscribe</span>
			</a>
		</div>
	</div>
</div>

            </div>
        </div>
		
		<hr class="research-layout-divider"/>

        <main class="main--content col-xs-12 col-lg-8 col-lg-push-2">
            <div>
	
    


	

</div>
            <div class="richText">
	
    


	
		<div>
			<p>Royal <a href="https://www.trendmicro.com/vinfo/ph/security/definition/Ransomware">ransomware</a>, which is already one of the <a href="https://www.trendmicro.com/en_us/research/22/l/conti-team-one-splinter-group-resurfaces-as-royal-ransomware-wit.html">most notable ransomware families</a> of 2022, has gained additional notoriety in early May 2023 after it was used to attack IT systems in Dallas, Texas. Around the same period, <a href="https://twitter.com/Unit42_Intel/status/1653760405792014336">several researchers</a> on Twitter came across a new ransomware family called BlackSuit that targeted both Windows and Linux users. Additional Twitter posts mentioned <a href="https://twitter.com/Arkbird_SOLG/status/1653893301412548611">connections between BlackSuit and Royal</a>, which piqued our interest. We managed to retrieve and analyze a Windows 32-bit sample of the ransomware from Twitter.</p>
<p>In this blog entry, we analyze BlackSuit ransomware and how it compares to Royal Ransomware.</p>
<h1><span class="body-subhead-title">Encryption and leak site details</span></h1>
<p>Before delving into the main comparison between the two ransomware families, let’s first examine the encryption and leak site details of BlackSuit.</p>
<p>BlackSuit appends the <i>blacksuit</i> file extension to the files it encrypts, drops its ransom note into the directory, and lists its TOR chat site in the ransom note along with a unique ID for each of its victims.</p>

		</div>
	

</div>
            <div class="image">
	
    


	<figure class="image-figure">
		<a id="3f0d89" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-1.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-1.png" alt="Figure 1. The BlackSuit ransom note"/>
		</a>
   		<figcaption>Figure 1. The BlackSuit ransom note</figcaption>
	</figure>

</div>
            <div>




    
    
    <div class="richText">
	
    


	
		<div>
			<p>Its operators also set up a data leak site as part of their two-pronged extortion strategy to coerce victims into paying the ransom demand. Note that there is just a single victim currently listed on the leak site as of the time of writing.</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="976f99" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-2.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-2.png" alt="Figure 2. The BlackSuit TOR website"/>
		</a>
   		<figcaption>Figure 2. The BlackSuit TOR website</figcaption>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<h1><span class="body-subhead-title">Comparison between Royal ESXi and BlackSuit ESXi variants</span></h1>
<p>One of the BlackSuit ransomware samples we analyzed is an x64 ESXi version targeting Linux machines. An earlier <a href="https://twitter.com/Arkbird_SOLG/status/1653893301412548611?s=20">post on Twitter</a> revealed that YARA rules designed for BlackSuit’s Linux variant matched samples of the <a href="https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html">Royal ransomware Linux variant</a>.</p>
<p>After comparing both samples of the Royal and BlackSuit ransomware, it became apparent to us that they have an extremely high degree of similarity to each other. In fact, they’re nearly identical, with 98% similarities in functions, 99.5% similarities in blocks, and 98.9% similarities in jumps based on BinDiff, a comparison tool for binary files.</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="5cf93b" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-3a.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-3a.png" alt="Figure 3. Comparison of the Linux variants of BlackSuit and Royal ransomware "/>
		</a>
   		
	</figure>

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="5637e4" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-3b.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-3b.png" alt="Figure 3. Comparison of the Linux variants of BlackSuit and Royal ransomware "/>
		</a>
   		<figcaption>Figure 3. Comparison of the Linux variants of BlackSuit and Royal ransomware </figcaption>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>Further analysis found that BlackSuit employs command-line arguments that have a similar function to those used by Royal. However, there are some differences: The strings used in the arguments are different, with BlackSuit also including additional arguments not found in Royal.</p>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div class="responsive-table-wrap">
			<table cellpadding="1" cellspacing="0" border="1" width="100%">
<tbody><tr><th scope="col" style="text-align: center;">Royal Argument</th>
<th scope="col" style="text-align: center;">BlackSuit Argument</th>
<th scope="col" style="text-align: center;">Description</th>
</tr><tr><td height="101" width="368" style="text-align: center;">-id {32-byte characters}</td>
<td width="368" style="text-align: center;">-name {32-byte characters}</td>
<td width="368" style="text-align: center;">Used as the victim’s ID, which will be appended to the TOR link found in the dropped ransom note. The process exits if the argument is not provided, or if the provided characters do not have a length of 32 bytes</td>
</tr><tr><td height="21" width="368" style="text-align: center;">-ep</td>
<td width="368" style="text-align: center;">-percent {0-100}</td>
<td width="368" style="text-align: center;">Used to define the encryption parameter</td>
</tr><tr><td height="21" width="368" style="text-align: center;">-path {target path}</td>
<td width="368" style="text-align: center;">-p {target path}</td>
<td width="368" style="text-align: center;">Used to specify a target directory to encrypt</td>
</tr><tr><td height="41" width="368" style="text-align: center;">(Not in Royal)</td>
<td width="368" style="text-align: center;">-thrcount</td>
<td width="368" style="text-align: center;">Used to create a specified number of threads depending on infected machine‘s processor count  </td>
</tr><tr><td height="21" width="368" style="text-align: center;">(Not in Royal)</td>
<td width="368" style="text-align: center;">-skip {text file}</td>
<td width="368" style="text-align: center;">Used to specify a text file containing folders to skip </td>
</tr><tr><td height="41" width="368" style="text-align: center;">-stopvm</td>
<td width="368" style="text-align: center;">-killvm</td>
<td width="368" style="text-align: center;">Used to terminate VM-linked processes via the EXSCLi command</td>
</tr><tr><td height="21" width="368" style="text-align: center;">-vmonly</td>
<td width="368" style="text-align: center;">-allfiles</td>
<td width="368" style="text-align: center;">Encrypt all files</td>
</tr><tr><td rowspan="4" height="101" width="368" style="text-align: center;">(Not in Royal)</td>
<td rowspan="4" width="368" style="text-align: center;">-noprotect</td>
<td width="368" style="text-align: center;">CheckProcStarted</td>
</tr><tr><td height="20" width="368" style="text-align: center;">     /bin/sh -c ps &gt; PS_list</td>
</tr><tr><td height="20" width="368" style="text-align: center;">     does not drop the file PID</td>
</tr><tr><td height="41" width="368" style="text-align: center;">     does not check if the process has already been started</td>
</tr><tr><td rowspan="2" height="81" width="368" style="text-align: center;">-fork</td>
<td rowspan="2" width="368" style="text-align: center;">-vmsyslog</td>
<td width="368" style="text-align: center;">Used to create fork processes and terminate watchdog timers</td>
</tr><tr><td height="41" width="368" style="text-align: center;">Does not terminate processes with the string vmsyslogd in its name</td>
</tr><tr><td height="21" width="368" style="text-align: center;">-logs</td>
<td width="368" style="text-align: center;">-demonoff</td>
<td width="368" style="text-align: center;">Used to display terminal logs</td>
</tr></tbody></table>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<h5 style="text-align: center;">Table 1. A comparison of arguments for the Linux versions of BlackSuit and Royal</h5>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="311069" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-4a.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-4a.png" alt="Figure 4. Creation of threads based on the value of “-thrcount”"/>
		</a>
   		
	</figure>

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="5e0cb7" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-4b.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-4b.png" alt="Figure 4. Creation of threads based on the value of “-thrcount”"/>
		</a>
   		<figcaption>Figure 4. Creation of threads based on the value of “-thrcount”</figcaption>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>Meanwhile, the <i>skip</i> argument is used to indicate a text file that contains a list of folders to be skipped. </p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="346c16" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-5a.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-5a.png" alt="Figure 5. The “skip” argument used to enumerate folders to skip"/>
		</a>
   		
	</figure>

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="82c8ae" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-5b.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-5b.png" alt="Figure 5. The “skip” argument used to enumerate folders to skip"/>
		</a>
   		<figcaption>Figure 5. The “skip” argument used to enumerate folders to skip</figcaption>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>During file enumeration and encryption, each respective ransomware family avoids files with the following extensions and filenames:</p>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div class="responsive-table-wrap">
			<table cellpadding="1" cellspacing="0" border="1" width="100%">
<tbody><tr><th scope="col" style="text-align: center;">Royal</th>
<th scope="col" style="text-align: center;">BlackSuit</th>
</tr><tr><td><ul>
<li><span class="rte-red-bullet">.royal_u</span></li>
<li><span class="rte-red-bullet">.royal_w</span></li>
<li><span class="rte-red-bullet">.sf</span></li>
<li><span class="rte-red-bullet">.v00</span></li>
<li><span class="rte-red-bullet">.b00</span></li>
<li><span class="rte-red-bullet">royal_log_</span></li>
<li><span class="rte-red-bullet">readme</span></li>
</ul>
</td>
<td><ul>
<li><span class="rte-red-bullet">.blacksuit</span></li>
<li><span class="rte-red-bullet">.BlackSuit</span></li>
<li><span class="rte-red-bullet">.blacksuit_log_</span></li>
<li><span class="rte-red-bullet">.list_</span></li>
<li><span class="rte-red-bullet">.PID_</span></li>
<li><span class="rte-red-bullet">.PS_list</span></li>
<li><span class="rte-red-bullet">.PID_list_</span></li>
<li><span class="rte-red-bullet">.CID_list_</span></li>
<li><span class="rte-red-bullet">.sf</span></li>
<li><span class="rte-red-bullet">.v00</span></li>
<li><span class="rte-red-bullet">.b00</span></li>
<li><span class="rte-red-bullet">.README.BlackSuit.txt</span></li>
<li><span class="rte-red-bullet">.README.blacksuit.txt</span></li>
</ul>
</td>
</tr></tbody></table>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<h5 style="text-align: center;">Table 2. List of extensions and filenames skipped by both BlackSuit and Royal</h5>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>BlackSuit ransomware targets the following extensions if the <i>–allfiles</i> argument is not provided:</p>
<ul>
<li><span class="rte-red-bullet">.vmem</span></li>
<li><span class="rte-red-bullet">.vmdk</span></li>
<li><span class="rte-red-bullet">.nvram</span></li>
<li><span class="rte-red-bullet">.vmsd</span></li>
<li><span class="rte-red-bullet">.vmsn</span></li>
<li><span class="rte-red-bullet">.vmss</span></li>
<li><span class="rte-red-bullet">.vmtm</span></li>
<li><span class="rte-red-bullet">.vmxf</span></li>
<li><span class="rte-red-bullet">.vmxf</span></li>
<li><span class="rte-red-bullet">.vmx</span></li>
</ul>
<h1><span class="body-subhead-title">Intermittent encryption process</span></h1>
<p>The binaries for both BlackSuit and Royal use OpenSSL’s AES for encryption and employ <a href="https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html">similar intermittent encryption techniques</a> to accelerate the encryption of the victim’s files.</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="88c60e" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-6.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-6.png" alt="  Figure 6. Preparing the file for encryption"/>
		</a>
   		<figcaption>  Figure 6. Preparing the file for encryption</figcaption>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>Both BlackSuit and Royal prepare the files for encryption by rounding up the file size to the nearest multiple of 16, after which 41 bytes are added, possibly to account for the encryption header and other metadata.</p>
<p>Next, a check is performed for the file being encrypted to determine if it has a size that is greater than 0x40000h (approximately 262KB). If this condition is met, it will use the value set using <i>-percent</i>, which is represented here by the <i>i_ep</i> variable. If not, it will use the default, which is 100.</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="b7df25" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-7.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-7.png" alt="Figure 7. Calculation of bytes to be used for intermittent encryption"/>
		</a>
   		<figcaption>Figure 7. Calculation of bytes to be used for intermittent encryption</figcaption>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>The number of bytes to be used for intermittent encryption is then calculated using the same formula found in the Linux version of Royal ransomware:</p>
<table border="1" cellspacing="0" cellpadding="0">
<tbody><tr><td width="624" valign="top"><ul>
<li><span class="blockquote">N = (X/10)*(Original File Size / 100) then round down to multiples of 16<br />
                                                                                Where X is the value of “-percent”</span></li>
</ul>
</td>
</tr></tbody></table>
<p>The file size is again checked to calculate the amount of space to be allocated for the data and metadata. Finally, the keys to be used for encryption are prepared.<br />
</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="138c76" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-8.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-8.png" alt="Figure 8. Preparation of the keys to be used for AES encyption"/>
		</a>
   		<figcaption>Figure 8. Preparation of the keys to be used for AES encyption</figcaption>
	</figure>

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="5148e8" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-9.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-9.png" alt="Figure 9. The BlackSuit ransomware’s encryption routine"/>
		</a>
   		<figcaption>Figure 9. The BlackSuit ransomware’s encryption routine</figcaption>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>In the case of BlackSuit, as we previously mentioned, it appends the extension “.blacksuit” to encrypted files and drops a ransom note in the directory where the files are located.<i></i></p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="c68774" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-10.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-10.png" alt="Figure 10. The folder showing the encrypted files with the appended extension and the dropped ransom note"/>
		</a>
   		<figcaption>Figure 10. The folder showing the encrypted files with the appended extension and the dropped ransom note</figcaption>
	</figure>

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="5f8631" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-11.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-11.png" alt="Figure 11. The content of the ransom note"/>
		</a>
   		<figcaption>Figure 11. The content of the ransom note</figcaption>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<h1><span class="body-subhead-title">Comparison between Royal Win32 and BlackSuit Win32 variants</span></h1>
<p>In addition to the Linux-based sample, we also analyzed a Windows 32-bit version of BlackSuit, which also exhibits significant similarities with its Royal ransomware counterpart (93.2% similarity in functions, 99.3% in basic blocks, and 98.4% in jumps based on BinDiff).</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="ea290d" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-12a.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-12a.png" alt="   Figure 12. Comparison of the Linux variants of BlackSuit and Royal ransomware"/>
		</a>
   		
	</figure>

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="b0f485" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-12b.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-12b.png" alt="Figure 12. Comparison of the Linux variants of BlackSuit and Royal ransomware"/>
		</a>
   		<figcaption>Figure 12. Comparison of the Linux variants of BlackSuit and Royal ransomware</figcaption>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>Our analysis found that BlackSuit accepts the following command-line arguments:</p>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div class="responsive-table-wrap">
			<table cellpadding="1" cellspacing="0" border="1" width="100%">
<tbody><tr><th scope="col" style="text-align: center;"><b>Royal Arguments</b></th>
<th scope="col" style="text-align: center;"><b>BlackSuit Arguments</b></th>
<th scope="col" style="text-align: center;"><b>Description</b></th>
</tr><tr><td height="20" width="506" style="text-align: center;">-path {target path}</td>
<td width="506" style="text-align: center;">-p {target path}</td>
<td width="506" style="text-align: center;">If provided, will only encrypt the contents of the target path</td>
</tr><tr><td height="80" width="506" style="text-align: center;">-id {32-byte characters}</td>
<td width="506" style="text-align: center;">-name {32-byte characters}</td>
<td width="506" style="text-align: center;">Used as the victim’s ID, which will be appended to the TOR link found in the dropped ransom note. The process exits if the argument is not provided, or if the provided characters do not have a length of 32 bytes</td>
</tr><tr><td height="20" width="506" style="text-align: center;">-ep</td>
<td width="506" style="text-align: center;">-percent {0 to 100}</td>
<td width="506" style="text-align: center;">Used to define encyption parameters</td>
</tr><tr><td height="20" width="506" style="text-align: center;">(Not in Royal)</td>
<td width="506" style="text-align: center;">-list {text files}</td>
<td width="506" style="text-align: center;">Used to specify a text file containing the target directories to encrypt</td>
</tr><tr><td height="20" width="506" style="text-align: center;">(Not in Royal)</td>
<td width="506" style="text-align: center;">-delete</td>
<td width="506" style="text-align: center;">Used to delete itself</td>
</tr><tr><td height="20" width="506" style="text-align: center;">-networkonly</td>
<td width="506" style="text-align: center;">-network</td>
<td width="506" style="text-align: center;">Used to encrypt file shares connected to the system</td>
</tr><tr><td height="20" width="506" style="text-align: center;">-localonly</td>
<td width="506" style="text-align: center;">-local</td>
<td width="506" style="text-align: center;">Used to encrypt the local system only</td>
</tr><tr><td height="20" width="506" style="text-align: center;">-disablesafeboot</td>
<td width="506" style="text-align: center;">-disablesafeboot</td>
<td width="506" style="text-align: center;">Used to disable safeboot</td>
</tr><tr><td height="20" width="506" style="text-align: center;">-noprotect</td>
<td width="506" style="text-align: center;">-noprotect</td>
<td width="506" style="text-align: center;">Used to disable mutex creation</td>
</tr></tbody></table>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<h5 style="text-align: center;">Table 3. A comparison of arguments for the Win32 versions of BlackSuit and Royal</h5>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>While BlackSuit introduces different argument strings compared to Royal, their purpose remains similar. BlackSuit combines arguments from various Windows versions of Royal Ransomware, while also introducing new arguments such as &quot;-delete&quot; and &quot;-list&quot; that are specific to itself.</p>
<p>The -<i>delete</i> argument uses the following command to continuously check for the existence of its file by looking for the filename:</p>
<table border="1" cellspacing="0" cellpadding="0">
<tbody><tr><td width="624" valign="top"><p><span class="blockquote">cmd /v/c &quot;set f={Malware File Name}&amp;for /l %l in () do if exist !f! (del /f/a &quot;!f!&quot;) else (exit)&quot;</span></p>
</td>
</tr></tbody></table>
<p>If the file is found, it is immediately deleted. The command keeps running indefinitely until the file is deleted, at which point the loop will exit.</p>
<p>The <i>-list</i> argument is used to specify a text file containing target directories to encrypt. It loads the file using<i> ReadFileFAPI</i> then places the contents of the text file in a buffer. Note that the loaded text file is a sample text file we used for testing and not the format of the text file that will be loaded in an actual attack.</p>

		</div>
	

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="8626b8" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-13a.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-13a.png" alt="Figure 13. Loading the text file. Note that we loaded the sample text file to show that it loads the file when using the -list argument."/>
		</a>
   		
	</figure>

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="03d7d6" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-13b.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-13b.png" alt="Figure 13. Loading the text file. Note that we loaded the sample text file to show that it loads the file when using the -list argument."/>
		</a>
   		
	</figure>

</div>


    
    
    <div class="image">
	
    


	<figure class="image-figure">
		<a id="5044e0" href="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-13c.png" target="_blank" rel="noopener noreferrer">
			<img src="/content/dam/trendmicro/global/en/research/23/e/investigating-blacksuit-ransomware-similarities-to-royal-/blacksuit-13c.png" alt="Figure 13. Loading the text file. Note that we loaded the sample text file to show that it loads the file when using the -list argument."/>
		</a>
   		<figcaption>Figure 13. Loading the text file. Note that we loaded the sample text file to show that it loads the file when using the -list argument.</figcaption>
	</figure>

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>if <i>–disablesafeboot</i> is passed as an argument, it removes the &quot;safeboot&quot; value from the current boot entry in the Boot Configuration Data (BCD) and performs an immediate system restart via the following command:</p>
<table border="1" cellspacing="0" cellpadding="0">
<tbody><tr><td width="624" valign="top"><p><span class="blockquote">“%System%\bcdedit.exe&quot; /deletevalue {current} safeboot<br />
 shutdown.exe /r /t 0</span></p>
</td>
</tr></tbody></table>
<p>When encrypting network shares using the <i>-network</i> argument, BlackSuit will check if the IP address begins with the following numbers to ensure that it is encrypting local systems:<i></i></p>
<ul>
<li><span class="rte-red-bullet">192.168.</span></li>
<li><span class="rte-red-bullet">10.</span></li>
<li><span class="rte-red-bullet">100.</span></li>
<li><span class="rte-red-bullet"> 172.</span></li>
</ul>
<p>It avoids encrypting files with the following strings in their file path:</p>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div class="responsive-table-wrap">
			<table cellpadding="1" cellspacing="0" border="1" width="100%">
<tbody><tr><th scope="col" style="text-align: center;">Royal</th>
<th scope="col" style="text-align: center;">BlackSuit</th>
</tr><tr><td><ul>
<li><span class="rte-red-bullet">$recycle.bin</span></li>
<li><span class="rte-red-bullet">$windows.~bt</span></li>
<li><span class="rte-red-bullet">$windows.~ws</span></li>
<li><span class="rte-red-bullet">boot</span></li>
<li><span class="rte-red-bullet">google</span></li>
<li><span class="rte-red-bullet">mozilla</span></li>
<li><span class="rte-red-bullet">perflogs</span></li>
<li><span class="rte-red-bullet">tor browser</span></li>
<li><span class="rte-red-bullet">windows</span></li>
<li><span class="rte-red-bullet">windows.old</span></li>
<li><span class="rte-red-bullet">royal</span></li>
</ul>
</td>
<td><ul>
<li><span class="rte-red-bullet">Windows</span></li>
<li><span class="rte-red-bullet">ADMIN$</span></li>
<li><span class="rte-red-bullet">IPC$</span></li>
</ul>
</td>
</tr></tbody></table>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<h5 style="text-align: center;">Table 4. Royal and BlackSuit avoid encrypting files that have these strings</h5>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div class="responsive-table-wrap">
			<table cellpadding="1" cellspacing="0" border="1" width="100%">
<tbody><tr><th scope="col" style="text-align: center;">Royal</th>
<th scope="col" style="text-align: center;">BlackSuit</th>
</tr><tr><td width="290" valign="top"><ul>
<li><span class="rte-red-bullet">.exe</span></li>
<li><span class="rte-red-bullet">.dll</span></li>
<li><span class="rte-red-bullet">.bat</span></li>
<li><span class="rte-red-bullet">.lnk</span></li>
<li><span class="rte-red-bullet">.royal_u</span></li>
<li><span class="rte-red-bullet">.royal_w</span></li>
</ul>
</td>
<td width="290" valign="top"><ul>
<li><span class="rte-red-bullet">.exe</span></li>
<li><span class="rte-red-bullet">.dll</span></li>
<li><span class="rte-red-bullet">.BlackSuit</span></li>
<li><span class="rte-red-bullet">.blacksuit</span></li>
<li><span class="rte-red-bullet">README.BlackSuit.txt</span></li>
</ul>
</td>
</tr></tbody></table>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<h5 style="text-align: center;">Table 5. Royal and BlackSuit avoid encrypting files that contain these extensions</h5>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div>
			<p>BlackSuit ransomware also deletes shadow copies using the following command:</p>
<table border="1" cellspacing="0" cellpadding="0">
<tbody><tr><td width="624" valign="top"><p>&quot;%System%\vssadmin.exe&quot; Delete Shadows /All /Quiet</p>
</td>
</tr></tbody></table>
<h1><span class="body-subhead-title">Conclusion and insights</span></h1>
<p>The emergence of BlackSuit ransomware (with its similarities to Royal) indicates that it is either a new variant developed by the same authors, a copycat using similar code, or an affiliate of the Royal ransomware gang that has implemented modifications to the original family.</p>
<p>One possibility for BlackSuit’s creation is that, since the threat actors behind Royal (and <a href="https://www.trendmicro.com/en_us/research/22/l/conti-team-one-splinter-group-resurfaces-as-royal-ransomware-wit.html">Conti before it</a>) are one of the <a href="https://www.bleepingcomputer.com/news/security/fbi-and-cisa-warn-of-increasing-royal-ransomware-attack-risks/">most active ransomware groups in operation today</a>, this may have led to increased attention from other cybercriminals, who were then inspired to develop a similar ransomware in BlackSuit. Another option is that BlackSuit emerged from a splinter group within the original Royal ransomware gang.<b></b></p>
<p>Whatever the case may be, the emergence of another ransomware like BlackSuit provides further evidence that threat actors will always try to look for more effective tools for their attacks, from modifying existing code to developing unique ransomware families, to profit from their victims. As such, both organizations and individual users should remain vigilant when it comes to protecting their files and data from ransomware attacks.</p>
<h1><span class="body-subhead-title">Recommendations and solutions</span></h1>
<p>Organizations can defend against ransomware attacks by implementing a comprehensive security framework that directs resources towards establishing a strong defense strategy. Here are some recommendations:</p>
<ul>
<li><span class="rte-red-bullet">Create an inventory of assets and data</span></li>
<li><span class="rte-red-bullet">Identify authorized and unauthorized devices and software</span></li>
<li><span class="rte-red-bullet">Conduct audits of event and incident logs</span></li>
<li><span class="rte-red-bullet">Manage hardware and software configurations</span></li>
<li><span class="rte-red-bullet">Grant administrative privileges and access only when necessary</span></li>
<li><span class="rte-red-bullet">Monitor network ports, protocols, and services</span></li>
<li><span class="rte-red-bullet">Establish a whitelist of approved software applications</span></li>
<li><span class="rte-red-bullet">Implement measures for data protection, backup, and recovery</span></li>
<li><span class="rte-red-bullet">Enable multifactor authentication (MFA)</span></li>
<li><span class="rte-red-bullet">Deploy up-to-date security solutions across all system layers</span></li>
<li><span class="rte-red-bullet">Remain vigilant for early indications of an attack</span></li>
</ul>
<p>By adopting a multi-pronged approach to securing potential entry points, such as endpoints, emails, websites, and networks, organizations can detect and defend against malicious elements and suspicious activities, effectively safeguarding themselves from ransomware attacks.</p>
<p>A multilayered approach can help organizations guard possible entry points into their system (endpoint, email, web, and network). Security solutions can detect malicious components and suspicious behavior, which can help protect enterprises. </p>
<ul>
<li><span class="rte-red-bullet"><b><a href="https://www.trendmicro.com/en_us/business/products/detection-response.html">Trend Vision One™</a> provides multilayered protection and behavior detection, which helps block questionable behavior and tools before the ransomware can do any damage. </b></span></li>
<li><span class="rte-red-bullet"><b><a href="https://www.trendmicro.com/en_us/business/products/user-protection/sps/endpoint.html">Trend Micro Apex One™</a> offers next-level automated threat detection and response against advanced concerns such as fileless threats and ransomware, ensuring the protection of endpoints. <br />
  </b></span></li>
</ul>
<p><b><span class="body-subhead-title">Indicators of Compromise (IOCs)</span></b></p>

		</div>
	

</div>


    
    
    <div class="richText">
	
    


	
		<div class="responsive-table-wrap">
			<table cellpadding="1" cellspacing="0" border="1" width="100%">
<tbody><tr><th scope="col" style="text-align: center;">SHA256</th>
<th scope="col" style="text-align: center;">Detection name</th>
</tr><tr><td height="41" width="711" style="text-align: center;">90ae0c693f6ffd6dc5bb2d5a5ef078629c3d77f874b2d2ebd9e109d8ca049f2c</td>
<td width="711" style="text-align: center;">Ransom.Win32.BLACKSUIT.THEODBC</td>
</tr><tr><td height="41" width="711" style="text-align: center;">1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e</td>
<td width="711" style="text-align: center;">Ransom.Linux.BLACKSUIT.THEODBC</td>
</tr><tr><td height="41" width="711" style="text-align: center;">6ac8e7384767d1cb6792e62e09efc31a07398ca2043652ab11c090e6a585b310</td>
<td width="711" style="text-align: center;">Ransom.Win32.ROYAL.AA</td>
</tr><tr><td height="41" width="711" style="text-align: center;">4d7f6c6a051ecb1f8410243cd6941b339570165ebcfd3cc7db48d2a924874e99</td>
<td width="711" style="text-align: center;">Ransom.Win32.ROYAL.SMYECJYT</td>
</tr><tr><td height="41" width="711" style="text-align: center;">b57e5f0c857e807a03770feb4d3aa254d2c4c8c8d9e08687796be30e2093286c</td>
<td width="711" style="text-align: center;">Ransom.Linux.ROYAL.THBOBBC</td>
</tr></tbody></table>

		</div>
	

</div>


</div>
            <section class="tag--list">
	<div class="tag--list-title">Tags</div>
	<div class="tag--list-tags">
		<a href="/en_us/research.html?category=trend-micro-research:environments/endpoints" class="tag--list-anchor">Endpoints</a>
		
			<span class="tag--list-separator" role="separator">|</span>
		
	
		<a href="/en_us/research.html?category=trend-micro-research:threats/ransomware" class="tag--list-anchor">Ransomware</a>
		
			<span class="tag--list-separator" role="separator">|</span>
		
	
		<a href="/en_us/research.html?category=trend-micro-research:article-type/research" class="tag--list-anchor">Research</a>
		
			<span class="tag--list-separator" role="separator">|</span>
		
	
		<a href="/en_us/research.html?category=trend-micro-research:medium/article" class="tag--list-anchor">Articles, News, Reports</a>
		
	</div>
</section>

        </main>

        <sidebar class="sidebar--left col-xs-12 col-lg-2 col-lg-pull-8">
            


<h3 class="article-authors__title">
	
		Authors
	
</h3>

<!-- /* Show Trend Micro if we don't have any authors for this article */ -->


<ul class="article-authors__list">
	<li class="article-authors__list-items">
		
		<div class="article-authors__wrapper" role="contentinfo authors profile">
			
			
				<p class="article-authors__list-items__name">Katherine Casona</p>
			
			<p class="article-authors__list-items__position">Threat Analyst</p>
		</div>
	</li>

	<li class="article-authors__list-items">
		
		<div class="article-authors__wrapper" role="contentinfo authors profile">
			
			
				<p class="article-authors__list-items__name">Ivan Nicole Chavez</p>
			
			<p class="article-authors__list-items__position">Threat Analyst</p>
		</div>
	</li>

	<li class="article-authors__list-items">
		
		<div class="article-authors__wrapper" role="contentinfo authors profile">
			
			
				<p class="article-authors__list-items__name">Ieriz Nicolle Gonzalez</p>
			
			<p class="article-authors__list-items__position">Threat Analyst</p>
		</div>
	</li>

	<li class="article-authors__list-items">
		
		<div class="article-authors__wrapper" role="contentinfo authors profile">
			
			
				<p class="article-authors__list-items__name">Jeffrey Francis Bonaobra</p>
			
			<p class="article-authors__list-items__position">Threat Research Engineer</p>
		</div>
	</li>
</ul>

<div class="article-authors__btn-wrapper" role="button">
	<a class="article-authors__button " href="mailto:tm_research@trendmicro.com" target="target" id="article-authors-contact-us-button">
		Contact Us
	</a>
</div>

<div class="article-authors__btn-wrapper subscribe-wrapper" role="button">
	<a class="article-authors__button subscribe " href="https://resources.trendmicro.com/subscription-us.html" data-modal-title="Subscribe" target="target">
		Subscribe
	</a>
</div>
	

    

        </sidebar>

        <sidebar class="sidebar--right col-xs-12 col-lg-2">
            <div class="sidebar--wrapper" role="contentinfo sidebar">
                <div class="row-1" role="contentinfo related articles">
                    
	
    


	<div class="related--articles" role="contentinfo related articles">
		<h3 class="related--articles-title">Related Articles</h3>
		 <ul class="related--articles-items">
			<li class="related--articles-item">
				<a class="related--articles-item-anchor" href="/en_us/research/22/c/this-week-in-security-news-march-25-2022.html">
					This Week in Security News - March 25, 2022
				</a> 
			</li>
		
			<li class="related--articles-item">
				<a class="related--articles-item-anchor" href="/en_us/research/22/c/this-week-in-security-news-march-18-2022.html">
					This Week in Security News - March 18, 2022
				</a> 
			</li>
		
			<li class="related--articles-item">
				<a class="related--articles-item-anchor" href="/en_us/research/22/c/this-week-in-security-news-march-4-2022.html">
					This Week in Security News March 4, 2022
				</a> 
			</li>
		</ul>
	</div>

	<div class="archived--link">
		<div class="archived--link-text">
			<a href="/en_us/research.html">
				See all articles
			</a>
		</div>

		<div class="archived--link-icon">
			<a href="/en_us/research.html">
				<span class="icon-chevron-right"></span>
			</a>
		</div>
	</div>


                </div>
            </div>
        </sidebar>
    </article>
</div></div>

    
</div>
</div>
<div class="footer">




<div class="containerV1"><div class="footer_wrapper footer-wrapper"><div class="containerV1">
	<div class="container-content">
		
		<div class="responsiveColumnControlV1 section">







<div class="row  global-margin-top-none global-padding-top-none global-padding-bottom-none global-margin-bottom-none" id="responsive-column-ece706b9-49dc-4d12-82e2-51aabb4aa42e">
	<div class="col-sm-12 col-xs-12 col-md-4 column"><div class="footer section">


	<div class="createAccount">
	<div class="containerV1 section">





<style>
@media ( min-width: 1024px ){
	#container41bc8b1e-9ad0-464e-9986-8b32b3521b46,
	.container41bc8b1e-9ad0-464e-9986-8b32b3521b46 {
		height: auto;

		background-repeat: no-repeat;
		background-size: cover;
	}
}

@media ( max-width: 1023px ) and ( min-width: 768px ){
	#container41bc8b1e-9ad0-464e-9986-8b32b3521b46,
	.container41bc8b1e-9ad0-464e-9986-8b32b3521b46 {
		height: auto;

		background-repeat: no-repeat;
		background-size: cover;
	}
}

@media ( max-width: 767px ){
	#container41bc8b1e-9ad0-464e-9986-8b32b3521b46,
	.container41bc8b1e-9ad0-464e-9986-8b32b3521b46 {
		height: auto;

		background-repeat: no-repeat;
		background-size: cover;
	}
}
</style>


<div id="container41bc8b1e-9ad0-464e-9986-8b32b3521b46" class="container41bc8b1e-9ad0-464e-9986-8b32b3521b46 container-wrap  gray-border global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none rounded-corners-all-20 ">
	

	<section>
		<div class="container-content">
			<div class="prod-content"><div class="text primary-color-white section">
<div id="text-db3f030b20" class="cmp-text">
    <p>Try our services free for 30 days</p>

</div>

    

</div>
<div class="buttonArrayV1 section">





<ul class="button-array small center-align global-margin-top-none global-margin-bottom-none global-padding-top-none global-padding-bottom-none">
	<li class="button-array-list">
		
	<a class="button  primary color-ffffff normal" id="footer-free-trial-f1f976" href="/en_us/business/products/trials.html#detection-response">
		Start your free trial today
	</a>

	</li>
</ul>
</div>

</div>
		</div>
	</section>
</div>
</div>
<div class="footer section">




	

<ul class="social-media-links">
	
	<li>
		<a href="https://www.linkedin.com/company/trend-micro/" class="social-icon linkedin" target="_blank" rel="noopener noreferrer">
			
			
			
				<svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18">
					<path id="LinkedIn" d="M8.8,10.3a1.5,1.5,0,0,1,1.5-1.5H25.295A1.5,1.5,0,0,1,26.8,10.3V25.294A1.5,1.5,0,0,1,25.3,26.8H10.3a1.5,1.5,0,0,1-1.5-1.5Zm7.125,5.359h2.437v1.224a2.793,2.793,0,0,1,2.6-1.337c2.593,0,3.207,1.4,3.207,3.973v4.763H21.55V20.109c0-1.465-.352-2.291-1.245-2.291-1.24,0-1.755.891-1.755,2.291v4.178H15.925Zm-4.5,8.512H14.05V15.55H11.425v8.624Zm3-11.437a1.688,1.688,0,1,1-.507-1.17A1.689,1.689,0,0,1,14.425,12.737Z" transform="translate(-8.8 -8.8)" fill="#020607" fill-rule="evenodd"/>
				</svg>

			
			
			
		</a>
	</li>
	
	<li>
		<a href="https://www.facebook.com/TrendMicro/" class="social-icon facebook" target="_blank" rel="noopener noreferrer">
			
				<svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18">
					<path id="Facebook" d="M56.087,8.8A3.28,3.28,0,0,0,52.8,12.087V23.513A3.28,3.28,0,0,0,56.087,26.8H62.28V19.763H60.419V17.229H62.28V15.065c0-1.7,1.1-3.262,3.632-3.262a15.371,15.371,0,0,1,1.784.1l-.06,2.366s-.773-.007-1.617-.007c-.913,0-1.06.421-1.06,1.119v1.85h2.75l-.12,2.533h-2.63V26.8h2.554A3.28,3.28,0,0,0,70.8,23.513V12.087A3.28,3.28,0,0,0,67.513,8.8H56.087Z" transform="translate(-52.8 -8.8)" fill="#020607"/>
				</svg>
			
			
			
			
			
		</a>
	</li>
	
	<li>
		<a href="https://twitter.com/trendmicro" class="social-icon twitter" target="_blank" rel="noopener noreferrer">
			
			
			
			
				<svg xmlns="http://www.w3.org/2000/svg" width="20" height="16" viewBox="0 0 20 16">
					<path id="Twitter" d="M116,11.5a8.307,8.307,0,0,1-2.356.635,4.055,4.055,0,0,0,1.8-2.235,8.271,8.271,0,0,1-2.6.979,4.154,4.154,0,0,0-4.934-.8,4.064,4.064,0,0,0-1.8,1.9,3.981,3.981,0,0,0-.256,2.586,11.806,11.806,0,0,1-4.685-1.225,11.625,11.625,0,0,1-3.772-2.995,3.991,3.991,0,0,0-.071,3.936,4.063,4.063,0,0,0,1.341,1.456,4.142,4.142,0,0,1-1.858-.505v.052a4,4,0,0,0,.928,2.558,4.117,4.117,0,0,0,2.364,1.4,4.2,4.2,0,0,1-1.853.069,4.042,4.042,0,0,0,1.46,2.007,4.15,4.15,0,0,0,2.374.8,8.321,8.321,0,0,1-5.1,1.729A8.491,8.491,0,0,1,96,23.785a11.741,11.741,0,0,0,6.289,1.814,11.5,11.5,0,0,0,11.676-11.489c0-.173-.005-.349-.012-.522A8.284,8.284,0,0,0,116,11.5Z" transform="translate(-96 -9.6)" fill="#020607"/>
				</svg>

			
			
		</a>
	</li>
	
	<li>
		<a href="https://www.instagram.com/trendmicro/" class="social-icon instagram" target="_blank" rel="noopener noreferrer">
			
			
				<svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 18 18">
					<path id="Instagram" d="M146.09,8.854c.959-.044,1.265-.054,3.71-.054s2.751.011,3.71.054a6.631,6.631,0,0,1,2.186.418,4.607,4.607,0,0,1,2.631,2.632,6.641,6.641,0,0,1,.419,2.184c.044.961.054,1.267.054,3.711s-.011,2.751-.054,3.711a6.61,6.61,0,0,1-.419,2.184,4.6,4.6,0,0,1-2.631,2.632,6.626,6.626,0,0,1-2.185.419c-.96.044-1.266.054-3.711.054s-2.751-.011-3.71-.054a6.6,6.6,0,0,1-2.185-.419,4.595,4.595,0,0,1-2.633-2.631,6.643,6.643,0,0,1-.419-2.185c-.044-.961-.054-1.267-.054-3.711s.01-2.751.054-3.71a6.611,6.611,0,0,1,.419-2.186A4.611,4.611,0,0,1,143.9,9.272a6.65,6.65,0,0,1,2.185-.418Zm7.346,1.62c-.949-.043-1.234-.052-3.636-.052s-2.687.009-3.636.052a4.976,4.976,0,0,0-1.673.31,2.972,2.972,0,0,0-1.708,1.708,4.968,4.968,0,0,0-.31,1.671c-.044.949-.053,1.234-.053,3.637s.009,2.688.053,3.637a4.968,4.968,0,0,0,.31,1.671,2.972,2.972,0,0,0,1.708,1.708,4.976,4.976,0,0,0,1.673.31c.949.043,1.232.052,3.636.052s2.688-.009,3.636-.052a4.976,4.976,0,0,0,1.673-.31,2.972,2.972,0,0,0,1.708-1.708,4.968,4.968,0,0,0,.31-1.671c.043-.949.053-1.234.053-3.637s-.01-2.688-.053-3.637a4.968,4.968,0,0,0-.31-1.671,2.972,2.972,0,0,0-1.708-1.708A4.976,4.976,0,0,0,153.436,10.474Zm-4.786,10.1a3,3,0,1,0-1.075-.758A3,3,0,0,0,148.65,20.574Zm-2.121-6.046a4.626,4.626,0,1,1-1.355,3.271A4.634,4.634,0,0,1,146.529,14.529Zm8.924-.666a1.091,1.091,0,0,0,.25-.355,1.1,1.1,0,0,0,.093-.425,1.093,1.093,0,1,0-.343.78Z" transform="translate(-140.8 -8.8)" fill="#020607" fill-rule="evenodd"/>
				</svg>
			
			
			
			
		</a>
	</li>
	
	<li>
		<a href="https://www.youtube.com/user/TrendMicroInc" class="social-icon youtube" target="_blank" rel="noopener noreferrer">
			
			
			
			
			
				<svg xmlns="http://www.w3.org/2000/svg" width="24.003" height="16.01" viewBox="0 0 24.003 16.01">
					<path id="YouTube" d="M205.9,12.112a2.78,2.78,0,0,0-.765-1.27A3.052,3.052,0,0,0,203.8,10.1c-1.877-.495-9.4-.495-9.4-.495a76.616,76.616,0,0,0-9.39.47,3.156,3.156,0,0,0-1.339.76,2.9,2.9,0,0,0-.777,1.276A29.133,29.133,0,0,0,182.4,17.6a29.058,29.058,0,0,0,.489,5.494,2.818,2.818,0,0,0,.775,1.269,3.094,3.094,0,0,0,1.341.743c1.9.494,9.39.494,9.39.494a76.8,76.8,0,0,0,9.4-.47,3.051,3.051,0,0,0,1.339-.742,2.785,2.785,0,0,0,.765-1.27,28.339,28.339,0,0,0,.5-5.495,26.534,26.534,0,0,0-.5-5.517ZM192,21.029V14.182l6.26,3.424Z" transform="translate(-182.4 -9.6)" fill="#020607"/>
				</svg>

			
		</a>
	</li>
	
</ul>


</div>


</div>




</div>

</div>

	<div class="col-sm-12 col-xs-12 col-md-8 column"><div class="responsiveColumnControlV1 section">







<div class="row  global-margin-top-none global-padding-top-none global-padding-bottom-none global-margin-bottom-none" id="responsive-column-e9678a2c-49a8-43d0-b148-7175c6b1c037">
	<div class="col-sm-12 col-xs-12 col-md-4 column"><div class="footer section">

	<div class="footerMenu">
	<h3>Resources</h3>
	
		<ul>
			
				<li><a href="/en_us/research.html" target="_self" rel="noopener noreferrer">Blog</a></li>
			
				<li><a href="https://trendmicro.com/newsroom" target="_self" rel="noopener noreferrer">Newsroom</a></li>
			
				<li><a href="https://www.trendmicro.com/vinfo/us/security/research-and-analysis/threat-reports" target="_self" rel="noopener noreferrer">Threat Reports</a></li>
			
				<li><a href="/en_us/devops.html" target="_self" rel="noopener noreferrer">DevOps Resource Center</a></li>
			
				<li><a href="/en_us/ciso.html" target="_self" rel="noopener noreferrer">CISO Resource Center</a></li>
			
				<li><a href="/en_us/partners/find-a-partner.html" target="_self" rel="noopener noreferrer">Find a Partner</a></li>
			
		</ul>
	
</div>






</div>

</div>

	<div class="col-sm-12 col-xs-12 col-md-4 column"><div class="footer section">

	<div class="footerMenu">
	<h3>Support</h3>
	
		<ul>
			
				<li><a href="https://success.trendmicro.com/dcx/s/?language=en_US" target="_blank" rel="noopener noreferrer">Business Support Portal</a></li>
			
				<li><a href="/en_us/business/get-info-form.html" target="_self" rel="noopener noreferrer">Contact Us</a></li>
			
				<li><a href="/en_us/business/products/downloads.html" target="_self" rel="noopener noreferrer">Downloads</a></li>
			
				<li><a href="/en_us/business/products/trials.html" target="_self" rel="noopener noreferrer">Free Trials</a></li>
			
				<li><a target="_self" rel="noopener noreferrer"></a></li>
			
				<li><a target="_self" rel="noopener noreferrer"></a></li>
			
		</ul>
	
</div>






</div>

</div>

	<div class="col-sm-12 col-xs-12 col-md-4 column"><div class="footer section">

	<div class="footerMenu">
	<h3>About Trend</h3>
	
		<ul>
			
				<li><a href="/en_us/about.html" target="_self" rel="noopener noreferrer">About Us</a></li>
			
				<li><a href="/en_us/about/careers.html" target="_self" rel="noopener noreferrer">Careers</a></li>
			
				<li><a href="/en_us/contact.html" target="_self" rel="noopener noreferrer">Locations</a></li>
			
				<li><a href="/en_us/about/events.html" target="_self" rel="noopener noreferrer">Upcoming Events</a></li>
			
				<li><a href="/en_us/about/trust-center.html" target="_self" rel="noopener noreferrer">Trust Center</a></li>
			
				<li><a target="_self" rel="noopener noreferrer"></a></li>
			
		</ul>
	
</div>






</div>

</div>
</div>
</div>

</div>
</div>
</div>
<div class="responsiveColumnControlV1 section">







<div class="row  global-margin-top-none global-padding-top-none global-padding-bottom-none global-margin-bottom-none" id="responsive-column-ee0618e6-a1e7-40e1-871a-16dac2012d74">
	<div class="col-sm-12 col-xs-12 col-md-3 column"><div class="footer section">



	
<div class="country-selection">
	<p>Select a country / region</p>
	<div class="dropup position-unset">
		<button class="btn btn-default dropdown-toggle" type="button" id="countryMenu" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
			<span class="stateSelect"></span>
			<span class="material-symbols-outlined">
			expand_more</span>
		</button>
		<div class="row dropdown-menu" aria-labelledby="countryMenu">
			<span class="material-symbols-outlined icon-close">close</span>
			
				<div class="coloumn col-xs-12 col-sm-6 col-md-2">
					<h4>The Americas</h4>
					<ul>
						
							<li>
								<a href="/en_us.html">United States</a>
							</li>
						
							<li>
								<a href="/pt_br.html">Brasil</a>
							</li>
						
							<li>
								<a href="/en_ca.html">Canada</a>
							</li>
						
							<li>
								<a href="/es_mx.html">México</a>
							</li>
						
					</ul>
				</div>
			
				<div class="coloumn col-xs-12 col-sm-6 col-md-2">
					<h4>Middle East &amp; Africa</h4>
					<ul>
						
							<li>
								<a href="/en_za.html">South Africa</a>
							</li>
						
							<li>
								<a href="/en_ae.html">Middle East and North Africa</a>
							</li>
						
					</ul>
				</div>
			
				<div class="coloumn col-xs-12 col-sm-6 col-md-4">
					<h4>Europe</h4>
					<ul>
						
							<li>
								<a href="/en_be.html">België (Belgium)</a>
							</li>
						
							<li>
								<a href="http://www.trendmicro.cz/">Česká Republika</a>
							</li>
						
							<li>
								<a href="/en_dk.html">Danmark</a>
							</li>
						
							<li>
								<a href="/de_de.html">Deutschland, Österreich Schweiz</a>
							</li>
						
							<li>
								<a href="/es_es.html">España</a>
							</li>
						
							<li>
								<a href="/fr_fr.html">France</a>
							</li>
						
							<li>
								<a href="/en_ie.html">Ireland</a>
							</li>
						
							<li>
								<a href="/it_it.html">Italia</a>
							</li>
						
							<li>
								<a href="/en_nl.html">Nederland</a>
							</li>
						
							<li>
								<a href="/en_no.html">Norge (Norway)</a>
							</li>
						
							<li>
								<a href="/pl_pl.html">Polska (Poland)</a>
							</li>
						
							<li>
								<a href="/en_fi.html">Suomi (Finland)</a>
							</li>
						
							<li>
								<a href="/en_se.html">Sverige (Sweden)</a>
							</li>
						
							<li>
								<a href="/tr_tr.html">Türkiye (Turkey)</a>
							</li>
						
							<li>
								<a href="/en_gb.html">United Kingdom</a>
							</li>
						
					</ul>
				</div>
			
				<div class="coloumn col-xs-12 col-sm-6 col-md-4">
					<h4>Asia &amp; Pacific</h4>
					<ul>
						
							<li>
								<a href="/en_au.html">Australia</a>
							</li>
						
							<li>
								<a href="/ru_ru.html">Центральная Азия (Central Asia)</a>
							</li>
						
							<li>
								<a href="/en_hk.html">Hong Kong (English)</a>
							</li>
						
							<li>
								<a href="/zh_hk.html">香港 (中文) (Hong Kong) </a>
							</li>
						
							<li>
								<a href="/en_in.html">भारत गणराज्य (India)</a>
							</li>
						
							<li>
								<a href="/in_id.html">Indonesia</a>
							</li>
						
							<li>
								<a href="/ja_jp.html">日本 (Japan)</a>
							</li>
						
							<li>
								<a href="/ko_kr/business.html">대한민국 (South Korea)</a>
							</li>
						
							<li>
								<a href="/en_my.html">Malaysia</a>
							</li>
						
							<li>
								<a href="/en_us.html">Монголия (Mongolia) and рузия (Georgia)</a>
							</li>
						
							<li>
								<a href="/en_nz.html">New Zealand</a>
							</li>
						
							<li>
								<a href="/en_ph.html">Philippines</a>
							</li>
						
							<li>
								<a href="/en_sg.html">Singapore</a>
							</li>
						
							<li>
								<a href="/zh_tw.html">台灣 (Taiwan)</a>
							</li>
						
							<li>
								<a href="/th_th.html"> ประเทศไทย (Thailand)</a>
							</li>
						
							<li>
								<a href="/vi_vn.html">Việt Nam</a>
							</li>
						
					</ul>
				</div>
			
		</div>
	</div>
</div>




</div>

</div>

	<div class="col-sm-12 col-xs-12 col-md-9 column"><div class="horizontalSeparatorV1 section">



<style>
.horizontalSeparator-ee4706fe-1515-4653-80dd-99a96cad0b41.border {
		border-bottom: 1px solid #bcbdc0;
}
</style>
<div id="horizontalV1-ee4706fe-1515-4653-80dd-99a96cad0b41" class="global-margin-top- global-margin-bottom-default global-padding-top-default global-padding-bottom- border horizontalSeparator-ee4706fe-1515-4653-80dd-99a96cad0b41">
	
</div>


</div>
<div class="responsiveColumnControlV1 section">







<div class="row  global-margin-top-none global-padding-top-none global-padding-bottom-none global-margin-bottom-none" id="responsive-column-e95a0d3b-794b-4bbf-8824-f255b9ef45e6">
	<div class="col-sm-12 col-xs-12 col-md-6 column"><div class="text primary-color-white font-interstate-light font-size-14 section">
<div id="privacyLink" class="cmp-text">
    <p><a title="privacy" href="/en_us/about/trust-center/privacy.html">Privacy</a> <b>|</b> <a title="Legal" href="/en_us/about/legal.html">Legal</a> <b>|</b> <a title="Accessibility" href="/en_us/about/legal/accessibility-policy.html">Accessibility</a> <b>|</b> <a title="Site map" href="/en_us/business/sitemap.html">Site map</a></p>

</div>

    

</div>

</div>

	<div class="col-sm-12 col-xs-12 col-md-6 column"><div class="text primary-color-white font-interstate-light font-size-14 section">
<div id="copyText" class="cmp-text">
    <p style="text-align: right;">Copyright ©2023 Trend Micro Incorporated. All rights reserved</p>

</div>

    

</div>

</div>
</div>
</div>

</div>
</div>
</div>


	</div>
</div>

	
    
<script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/jquery.min.js"></script>
<script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/utils.min.js"></script>
<script type="text/javascript" src="/etc.clientlibs/clientlibs/granite/jquery/granite.min.js"></script>
<script type="text/javascript" src="/etc.clientlibs/trendmicro/editableTemplateComponents/content/footer/v1/footer/clientLibs.min.js"></script>




</div>
</div></div>


			

<!-- /* Core functionality javascripts, absolute URL to leverage Akamai CDN */ -->
<script src="https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js"></script>
<script src="https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js"></script>

<script type="text/javascript" src="https://www.youtube.com/iframe_api"></script>

            
    
    
<script type="text/javascript" src="/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js"></script>
<script type="text/javascript" src="/etc.clientlibs/trendmicro/clientlibs/trendmicro-core-2/clientlibs/header-footer.min.js"></script>



    


    

    

    
    

            

            
			<!--For Modal-start-->
			<div class="modal-wrap"></div>
			<div class="jwPlayerString hidden">
				<span>sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk</span>
			</div>
			<!--For Modal-end-->
        

		<!-- Go to www.addthis.com/dashboard to customize your tools -->
		<script type="text/javascript" src="//s7.addthis.com/js/300/addthis_widget.js#pubid=ra-57bc9d0c3028a052"></script>		
    </body>
</html>
